Latest / Tech Talks With Kinsoft / McGraw Hill – 13.5M Exposed via Salesforce Misconfig

Transcript

McGraw Hill – 13.5M Exposed via Salesforce Misconfig · Tech Talks With Kinsoft

0:00
Welcome to Tech Talks with Kinsoft. Glad to be
0:02
here. So today's mission is to unpack a really
0:06
massive cybersecurity failure. And I mean, we
0:10
want to extract the most vital lessons. about
0:13
modern software risks from it yeah it's it's
0:16
a huge topic it really is we're looking at how
0:18
organizations manage those complex often completely
0:22
invisible connections between the software they
0:25
use every single day right and what happens when
0:27
those connections are just neglected exactly
0:30
yeah so i want you to imagine for just a second
0:33
that you're in charge of building an impenetrable
0:35
digital fortress. Right. You spare absolutely
0:38
no expense. You got the moats, the armed guards,
0:40
all of it. Yeah, the state -of -the -art laser
0:42
grids covering the front door. You are entirely
0:44
secure. But then, completely by accident, you
0:47
leave a hidden ground floor side window, just
0:49
wide open. Oh, man. And not just open, but, like,
0:52
propped open for literally anyone walking past
0:54
to see. Right. And this scenario, it isn't some
0:57
hypothetical nightmare. This is exactly what
0:59
happened to the K -12 and professional education
1:01
giant McGraw -Hill in April 2026. Yeah. And it
1:05
highlights a really painful reality in modern
1:08
IT infrastructure. You know, you can have the
1:12
strongest front door in the world. I mean, fortified
1:14
by multifactor authentication, cutting edge firewalls,
1:17
the works. Right. But if that side window is
1:19
left open, threat actors, they don't need to
1:22
pick a lock. They don't need to deploy some sophisticated
1:24
malware. They just walk in. They just climb right
1:26
in. And the resulting fallout is usually staggering.
1:29
Staggering is really the only word for it. I
1:31
mean, we are talking about. A data breach exposing
1:35
13 .5 million accounts. Yeah. And to really grasp
1:39
the scale of this failure, we first need to look
1:42
at the timeline, right? The timeline of the attack
1:45
and the threat actors who actually pulled it
1:47
off. Definitely. So the breach surfaced in mid
1:50
-April 2026. That's when this extortion group
1:53
known as Shiny Hunters. Right. Well -known group.
1:55
Yeah. They paraded McGraw Hill onto their dark
1:57
web leak site. Yeah. And they issued a ransom
2:00
demand. And it had a strict April 14 deadline
2:03
attached to it. Right. And that use of a public
2:05
countdown timer, that's a very specific psychological
2:07
tactic. Oh, really? How so? Well, it's designed
2:10
to bypass the normal, rational incident response
2:13
procedures of a corporation. It just creates
2:16
sheer panic in the boardroom. So they just want
2:19
to cause chaos. Exactly. They want executives
2:22
making rushed, fear -based decisions under extreme
2:25
public pressure. Right. Just hoping they pay
2:27
up. Yeah. Hoping someone just authorizes a payout
2:30
to make the whole PR nightmare disappear. But
2:32
McGraw -Hill, apparently they didn't cave to
2:36
that pressure or maybe the negotiations just
2:39
completely broke down behind the scenes. Right.
2:41
Because when that April 14 deadline passed without
2:43
a payment, shiny hunters actually followed through
2:46
on their threat. They dumped over 100 gigabytes
2:49
of data online. Which is a massive amount of
2:51
information. It's huge. But looking at the source
2:54
reports, there's this fascinating detail. Shiny
2:57
Hunters didn't just list McGraw -Hill on this
2:59
leak site. They also listed Rockstar Games. And
3:02
they claim to be holding over 40 million Salesforce
3:05
records containing PII. Personally identifiable
3:08
information. Right. Highly personal stuff. Which
3:11
kind of makes me wonder about the targeting here.
3:13
Does this mean McGraw -Hill wasn't specifically
3:15
targeted? That's the million dollar question.
3:18
Because McGraw -Hill is a massive institution.
3:20
They have millions of users across schools and
3:23
corporate training. Why wouldn't they be a high
3:26
value specific? It just feels like a goldmine,
3:30
not just some random catch in a dragnet. And
3:33
if so, how does that change how we should view
3:35
corporate security? Right. Well, it is a goldmine.
3:37
But the methodology of how they acquired it,
3:41
that points directly to a dragnet approach. Explain
3:44
that. If you look at Shiny Hunter's history,
3:47
especially a really similar campaign they ran
3:50
back in 2025, you see their operational model.
3:53
Right. They aren't spending months trying to
3:55
crack the... intricate, bespoke security systems
3:58
of individual companies. That takes too much
4:00
effort. Exactly. Trying to break down the front
4:03
door of a company like McGraw -Hill requires
4:05
massive resources, zero -day exploits, highly
4:08
specialized skills. The return on investment
4:11
for the hackers just isn't there when there's
4:14
an easier path. So if they aren't spending months
4:16
cracking the core system, they have to be finding
4:19
a skeleton key somewhere else. Bingo. How does
4:22
a dragnet actually work in this context then?
4:25
So they automate the discovery phase. Instead
4:27
of targeting a specific company, they target
4:30
a specific vulnerability or a misconfiguration
4:34
in connected cloud services. Okay. They write
4:37
scripts that just constantly scan the entire
4:39
internet. They're pinging millions of servers
4:42
and API endpoints looking for one specific flaw.
4:45
Wow. Just sweeping the web. Yeah. And in this
4:48
case, they were looking for misconfigured Salesforce
4:51
environments or exposed integrations. So they
4:54
really do just cast a massive net. Exactly. If
4:57
you happen to have that misconfiguration, your
4:59
data gets scooped up automatically. They don't
5:01
even care who you are. No, they don't care if
5:03
you're an education publisher like McGraw -Hill
5:05
or a video game developer like Rockstar Games.
5:08
To them... Data is just leverage. Man, that really
5:11
shifts the entire paradigm of how we think about
5:14
risk. You don't have to be a high -value target
5:16
to get hit. Not at all. You just have to be making
5:18
a really common administrative mistake, which
5:22
honestly brings us to the actual technical mechanism
5:24
of this brief. Right, the side door. Yeah. According
5:27
to the reports, McGraw -Hill claimed the leak
5:30
stemmed from a, quote, limited Salesforce -hosted
5:35
web page. Notice the phrasing there. Right. They
5:38
were incredibly quick to insist that there was
5:40
absolutely no unauthorized access to their core
5:42
Salesforce accounts, their customer databases,
5:44
courseware, or internal systems. Right. They
5:47
even went so far as to state that this appears
5:50
to be a broader issue involving a misconfiguration
5:53
within Salesforce's environment that has impacted
5:56
multiple organizations. Yeah, that right there
5:59
is a total masterclass in corporate crisis communication.
6:02
It really is. Notice that careful use of the
6:04
phrase within Salesforce's environment. Yeah.
6:07
They are actively attempting to shift the perception
6:09
of blame right onto their vendor. It's essentially
6:13
like hiring the best security firm on earth to
6:17
build a bank vault, right? Right. You have the
6:19
titanium doors, the time locks, the laser sensors.
6:22
But then one of your own employees. accidentally
6:25
tapes the architectural blueprint of the vault,
6:28
complete with the override codes, to a public
6:31
billboard out on the highway. Exactly. The bad
6:33
guys didn't break your vault. The vault worked
6:36
perfectly. They just bypassed it entirely because
6:39
you handed them the schematic. That's a great
6:41
way to put it. And what really raises major questions
6:44
about this figure pointing is that when journalists
6:47
reached out to Salesforce for a comment on this
6:50
supposed broader issue. Yeah, what did Salesforce
6:52
say? Salesforce gave no response. They totally
6:55
ghosted the media. Right. And that silence from
6:58
Salesforce speaks volumes about the shared responsibility
7:00
model. Which is what exactly? Well, it's arguably
7:04
the most misunderstood aspect of cloud computing
7:07
today. OK. When you use a massive platform like
7:09
Salesforce or Amazon Web Services, Microsoft
7:12
Azure. Yeah. The vendor is responsible for the
7:16
security of the cloud. Okay, so the physical
7:18
stuff. Yes, they secure the physical servers,
7:20
the data centers, the network infrastructure,
7:23
and the underlying code of the application itself.
7:26
But the customer, McGraw -Hill in this scenario,
7:29
is responsible for security in the cloud. Meaning
7:33
how they actually use the tool. Exactly. The
7:35
customer manages their own access controls, how
7:38
they configure public -facing portals, who they
7:40
give administrative rights to, and crucially,
7:43
what third -party applications they integrate
7:46
into the system. Oh, the integrations. Yeah.
7:49
Most compromises we see on these platforms do
7:51
not stem from a flaw in Salesforce's code. They
7:54
come from the users. Yes. They stem from user
7:57
end issues, stolen credentials, poor access management,
8:00
or abused OF apps. Okay, wait. Before we get
8:03
into the integrations themselves, what exactly
8:05
is an OF app? Is that like the login with Google
8:08
or login with Salesforce button I see everywhere
8:10
on the web? That is exactly what it is. Oh, really?
8:13
Yeah. OF is an open standard for access delegation.
8:16
It's what allows you to grant a website or application
8:19
access to your information. on another website
8:22
without giving them my actual password exactly
8:24
so when a marketing tool says connect to salesforce
8:27
to import your contacts it uses of it asks salesforce
8:32
for an access token if a mcgraw -hill administrator
8:35
clicks approve that marketing tool now has a
8:39
token that acts as a persistent invisible bridge
8:42
into the salesforce database wow and if i'm understanding
8:46
this correctly The problem isn't the bridge itself.
8:49
The problem is how wide you make the bridge and
8:51
who you let drive across it, right? Precisely.
8:53
We're talking about over -permissioned integrations.
8:55
That is the core issue here. Think of an integration
8:57
token like a valet key for your car. Okay. You
9:00
give the valet key to the parking attendant so
9:03
they can park the vehicle. It should only start
9:05
the ignition and open the driver's door. Right.
9:08
Nothing else. But if you accidentally give the
9:10
valet a master key, that also opens the glove
9:13
box, unlocks the trunk, and contains the code
9:16
to your home security system. Oh, man. Yeah,
9:18
you have over -permissioned that key. If that
9:21
valet key is stolen, the thief has access to
9:23
everything. But why do companies do this? If
9:27
IT departments know that over -permissioning
9:29
is dangerous, why do these master keys get handed
9:32
out to random marketing tools or connected web
9:34
pages? It usually just comes down to the friction
9:37
between business convenience and cybersecurity.
9:41
The classic battle. Always. Marketing teams,
9:43
sales teams, customer support, they need to move
9:45
quickly. They want to launch a new portal or
9:48
connect a new analytics dashboard today. Right.
9:50
But the IT security team is often backlogged.
9:54
So instead of taking the time to painstakingly
9:58
configure an integration so it only has read
10:01
-only access to three specific fields. Someone
10:04
just clicks up. Prove all. Basically. An administrator
10:07
might just check the box that grants global read
10:09
and write access to the entire database. It makes
10:12
the integration work instantly. Which makes the
10:14
business side happy. Exactly. But it creates
10:17
a massive silent vulnerability. Because to the
10:21
system, when that integration asks for data.
10:24
It looks entirely legitimate. It looks completely
10:26
normal. The integration has a valid token. It
10:29
was granted permission by an administrator. So
10:31
it just lets them in. Yeah. So when the attacker
10:33
compromises that third -party tool or finds an
10:36
exposed portal utilizing that token, the system
10:38
says, sure, here are the 100 gigabytes of data
10:41
you requested. That is terrifying. It turns the
10:44
ability to connect software seamlessly into a
10:47
devastating weapon. The attacker pulls the data
10:50
without ever triggering an intrusion alarm on
10:53
the core systems. The systems McGraw -Hill was
10:55
so eager to defend. Right. The data just leaks
10:58
out the side window while the armed guards at
11:00
the front door see absolutely nothing. Exactly.
11:03
Which really brings us to the human cost of this
11:05
failure. And honestly, the dizzying corporate
11:08
spin regarding what was actually stolen. Oh,
11:11
the spin was intense. Yeah, because... McGraw
11:14
-Hill immediately deployed a communication strategy
11:17
focused entirely on what wasn't taken. Right.
11:20
They announced that no social security numbers
11:22
were compromised, no financial account information,
11:26
no student data from their learning platforms.
11:29
It's the standard playbook for incident response,
11:32
really. Just calm everyone down. Yeah. The immediate
11:34
objective is to stop the bleeding of public trust.
11:37
And the easiest way to do that is to assure people
11:39
their bank accounts are safe. Which, I mean,
11:42
I'm certainly glad my credit card isn't floating
11:44
around the dark web. However, the security tracking
11:47
site have I been pwned independently confirmed
11:50
the scope of the 13 .5 million exposed records.
11:54
And it was a lot. It was. That data included
11:56
full names, personal phone numbers, email addresses,
11:59
and actual physical home addresses. Yeah. And
12:03
yet. McGraw -Hill categorized this as a limited
12:07
exposure of, quote, non -sensitive data. Right.
12:11
I have to say, if a criminal syndicate has my
12:14
full name, the email I use for everything, my
12:16
personal cell phone number, and the exact physical
12:19
address where I sleep at night. You don't feel
12:20
secure. I don't feel like the exposure is limited.
12:23
I feel entirely compromised. Absolutely. At what
12:25
point do we as an industry stop letting companies
12:28
use the phrase nonsensitive data as a get out
12:31
of jail free card to dismiss massive breaches?
12:33
Well, you are completely justified in feeling
12:36
compromised. The phrase nonsensitive is a dangerous
12:38
myth. Thank you. It really highlights a severe
12:41
disconnect between corporate liability and individual
12:43
risk. Oh, so? Well, legally and historically,
12:46
corporations fixate on social security numbers,
12:49
health care records and credit card numbers.
12:51
Right. Because those specific data points carry
12:53
direct regulatory fines and immediate financial
12:55
liability. If a credit card is stolen, fraud
12:58
occurs. Banks initiate chargebacks. So the company
13:02
actually faces measurable immediate damages.
13:04
Exactly. The company gets punished. So they care
13:06
about. that specific data but with names and
13:09
addresses they don't right but a hundred gigabyte
13:12
database of verified names active emails personal
13:15
phone numbers and physical addresses yeah That
13:18
is the ultimate starter kit for modern cybercrime.
13:21
Wow. It's the raw material needed to launch devastating
13:24
secondary attacks. It might not cost McGraw -Hill
13:27
money today, but it shifts an enormous burden
13:30
of defense directly onto the individuals. The
13:33
people whose data was actually exposed. Yes.
13:35
So walk us through how that secondary attack
13:38
actually plays out. If a threat actor buys this
13:40
McGraw -Hill data set off the dark web, what
13:43
do they actually do with my physical address
13:45
and my phone number? They use it to craft highly
13:47
- targeted, socially engineered attacks that
13:50
just completely bypass your natural skepticism.
13:52
Okay, give me an example. Let's say you receive
13:54
a text message on your phone. It addresses you
13:57
by your first and last name. Cool. It states
13:59
there's an issue with a package delivery or a
14:02
municipal utility notice. And it actually includes
14:05
your physical home address right in the text.
14:08
Oh, wow. Yeah, and it asks you to click a link
14:11
to verify delivery instructions. See, my brain
14:13
immediately drops its guard there. Because if
14:16
I get a generic text saying your package is delayed,
14:18
I usually just ignore it. Right. Everyone does.
14:21
But if the text says, we cannot deliver. to a
14:24
123 main street and that is my actual house do
14:27
you pay attention the context makes it feel totally
14:29
authentic exactly it leverages familiarity to
14:33
manufacture trust so you click the link which
14:36
takes you to a spoofed login page for a delivery
14:38
service or your email provider and i just hand
14:41
over my password you do or consider how this
14:44
data is used against your employer attackers
14:47
use this data set to profile you oh right they
14:50
call your company's i .t help desk pretending
14:53
to be you. They say they need to reset your password.
14:55
And the help desk asks security questions. Right.
14:58
And when the agent asks for verification, the
15:01
attacker has your home address, your personal
15:04
phone number, your personal email address, all
15:06
ready to go. Because they bought it from the
15:08
McGraw -Hill leak. Yes. They use that data to
15:11
authenticate themselves as you, gaining access
15:14
to your corporate network. Man, the danger really
15:17
just compounds. It does. I mean, it's technically
15:19
true that McGraw -Hill didn't lose your social
15:22
security number or your password. Right. But
15:24
they handed attackers the exact puzzle pieces
15:28
needed to trick you into handing those things
15:31
over yourself. And that is the reality of the
15:33
threat landscape today. When an organization
15:35
tells you a breach only involved non -sensitive
15:38
contact information, you just have to assume
15:41
that your details are now being actively used
15:43
to profile you. For sophisticated scams. Yes.
15:46
You have to become hypervigilant about every
15:49
unsolicited text, email or phone call that uses
15:52
your personal information to try and establish
15:54
credibility. Which is an incredibly heavy burden
15:57
to carry, especially when you trusted the institution
15:59
to begin with. Absolutely. And honestly, looking
16:02
at the entire scope of this breach, there is
16:05
a profound irony here that is just difficult
16:07
to ignore. Oh, for sure. We're talking on McGraw
16:10
Hill. I mean, this is an institution built entirely
16:12
on. digital learning platforms they provide assessments
16:16
educational software textbooks every spanning
16:18
from k -12 classrooms all the way through to
16:21
professional corporate training environments
16:24
they are fundamentally in the business of teaching
16:27
right and yet they just received a very public
16:30
very painful and very expensive lesson in digital
16:33
security yeah It serves as the ultimate cautionary
16:36
tale for any organization operating today. Really?
16:40
Yeah. It proves that no matter what your core
16:42
product is, whether you publish textbooks, develop
16:45
video games, or sell shoes, if you operate in
16:48
the modern world, you are a technology company
16:50
first. That's a great point. And if you do not
16:52
understand the complex web of integrations, APIs,
16:55
and permissions that make up your digital infrastructure,
16:57
you are deeply vulnerable. And as we've seen
17:00
today, that vulnerability isn't always some dramatic
17:03
hack with a team of cyber criminals deciphering
17:06
firewalls in a dark room. Usually it isn't. Sometimes
17:09
it's just a misconfigured setting on a web page.
17:12
Or an over -permissioned integration token that
17:14
some administrator approved to save time and
17:17
then completely forgot about. Which happens every
17:19
single day. Right. So what does this all mean
17:22
for you listening? I want to leave you with a
17:24
thought to mull over, extending beyond just the
17:27
headlines of this specific breach. Okay. Think
17:29
about all the third -party apps connected to
17:32
your own work email or your company software
17:34
right now. The calendar integrations, the project
17:37
management tools, the marketing plugins, the
17:40
simple web portals. There are dozens of them.
17:42
At least. If a tech -reliant titan like McGraw
17:45
-Hill can accidentally leave a digital window
17:47
wide open for anyone to find, how many invisible
17:50
over -permission connections are quietly sitting
17:52
in your own organization's tech stack, just waiting
17:56
for an automated scanner to discover them? It's
17:58
a scary thought. It really is. To discuss your
18:01
security and IT needs, visit www .kinsoft .com
18:05
.au.